Home

Description

EN DE

A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.

In thinkgem JeeSite bis 5.12.1 ist eine Schwachstelle entdeckt worden. Das betrifft die Funktion decodeUrl2 der Datei common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. Die Bearbeitung verursacht cross site scripting. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden. Das Aktualisieren auf Version 5.13.0 kann dieses Problem lösen. Der Patch heisst 63773c97a56bdb3649510e83b66c16db4754965b. Es wird empfohlen, die betroffene Komponente zu aktualisieren.

PUBLISHED Reserved 2025-09-01 | Published 2025-09-01 | Updated 2025-09-02 | Assigner VulDB




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
LOW: 3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
LOW: 3.5CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
4.0AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C

Problem types

Cross Site Scripting

Code Injection

Product status

5.12.0
affected

5.12.1
affected

5.13.0
unaffected

Timeline

2025-09-01:Advisory disclosed
2025-09-01:VulDB entry created
2025-09-01:VulDB entry last update

Credits

ZAST.AI (VulDB User) reporter

References

vuldb.com/?id.322111 (VDB-322111 | thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting) vdb-entry technical-description

vuldb.com/?ctiid.322111 (VDB-322111 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.641125 (Submit #641125 | thinkgem https://github.com/thinkgem/jeesite5 <=v5.12.1 XSS) third-party-advisory

github.com/thinkgem/jeesite5/issues/33 issue-tracking

github.com/thinkgem/jeesite5/issues/33 issue-tracking

github.com/thinkgem/jeesite5/issues/33 exploit issue-tracking

github.com/...ommit/63773c97a56bdb3649510e83b66c16db4754965b patch

github.com/thinkgem/jeesite5/releases/tag/v5.13.0.springboo3 patch

cve.org (CVE-2025-9796)

nvd.nist.gov (CVE-2025-9796)

Download JSON